CVE-2026-97901

A flaw was found in the Linux kernel's Generic Netlink (genetlink) component. This flaw allows a local user to cause a Denial of Service (DoS) through a system crash. The vulnerability occurs because the kernel fails to maintain a reference to the target module during a policy dump that spans multiple message buffers. If the target module is unloaded while the dump operation is pending, advancing the dump dereferences memory from the unloaded module.

A use after free in the Generic Netlink policy dump path occurs because a pending dump retains pointers to a target family policy and operation tables without pinning the target family module. If that module is unregistered and unloaded before the dump continues, a later dump callback can dereference memory belonging to the unloaded module. This can cause a local kernel crash and may permit limited information disclosure if freed memory is reused and exposed through the dump response. For the CVSS the paranoid score uses PR:L because a local user can initiate and retain the dump, although reliably creating the module unload condition normally requires separate administrative control. The issue is not network reachable because Generic Netlink is a local kernel interface. Impact is at least local denial of service via kernel crash. Limited confidentiality or integrity impact is possible in the paranoid assessment due to the UAF and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.